GX Works3 vulnerabilities

14 known vulnerabilities in GX Works3 from Mitsubishi Electric. 14 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  GX Works3: Incorrect Implementation of Authentication Algorithm

  CVE-2026-15688Sep 17, 2026Mitsubishi Electric

  Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify

• 7.8 High severity

  windriver: Improper Privilege Management

  CVE-2024-22106Jul 2, 2024Jungo

  Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Service (DoS).

• 9.8 Critical severity

  EZSocket: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2023-6943Jan 30, 2024Mitsubishi ElectricEPSS 2.13%

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions

• 7.5 High severity

  EZSocket: Missing Authentication for Critical Functionality

  CVE-2023-6942Jan 30, 2024Mitsubishi Electric

  Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions

• 7.8 High severity

  GX Works3: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2023-5247Nov 30, 2023Mitsubishi Electric

  Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted pro

• 7.8 High severity

  GX Works3: Incorrect Default Permissions

  CVE-2023-4088Sep 20, 2023Mitsubishi Electric

  Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denia

• 7.5 High severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29831Nov 25, 2022Mitsubishi ElectricEPSS 1.42%

  Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.

• 9.1 Critical severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29830Nov 25, 2022Mitsubishi ElectricEPSS 1.36%

  Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tam

• 7.5 High severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29829Nov 25, 2022Mitsubishi ElectricEPSS 1.16%

  Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U

• 7.5 High severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29828Nov 25, 2022Mitsubishi ElectricEPSS 1.16%

  Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project f

• 7.5 High severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29827Nov 25, 2022Mitsubishi ElectricEPSS 1.16%

  Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project f

• 7.5 High severity

  GX Works3: Cleartext Storage of Sensitive Information

  CVE-2022-29826Nov 25, 2022Mitsubishi Electric

  Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose

• 7.5 High severity

  GX Works3: Use of Hard-coded Credentials

  CVE-2022-29825Nov 25, 2022Mitsubishi Electric

  Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticated attacker to disclos

• 7.5 High severity

  GX Works3: Cleartext Storage of Sensitive Information

  CVE-2022-25164Nov 25, 2022Mitsubishi Electric

  Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensi